Hi folks,
I'm running the transaction command, in a drilldown panel that passes the times picked on the timechart down to the next panel as tokens. The problem I run into is where the transactions don't fall within the hour slice, I want the token to subtract and hour from the earliest time, and add an hour to the latest, so I can encompass the transaction.
I tried $earliest_time$ - 1h
Splunk says "Invalid earliest_time"
Is there a way to offset the tokens this way?
↧